2026 Bureau Vallée — misere supplier-export claim; 4.82M unique / 13.73M rows (unverified)
Data compromised
Per Dark Web Informer (unverified): 13.73M total / 4.82M unique customer records from bureau-vallee.fr via alleged third-party daily store exports; field list not published; 10k sample offered; injection/command-execution and persistent access claimed
Technical writeup
Unverified supplier-chain / forum sale claim — August 21, 2026 (Dark Web Informer). Actor misere advertised Bureau Vallée (bureau-vallee.fr) customer data citing 13.73M total records and 4.82M unique rows allegedly collected via a third-party that exported every store daily to an unprotected FTP server outside France, with claimed SQL injection/command execution and ~one month of persistent access still live at posting. No field list was published; a 10k sample was advertised. Bureau Vallée and the unnamed supplier had not confirmed at indexing. DWI links this mechanism to a Beauty Success listing posted ~19 minutes later by the same actor. recordsAffected 4820000 = actor unique-count (unverified).
Root cause
Unverified forum sale — actor misere claims daily per-store customer exports from a third-party supplier landed on an unprotected external FTP host with persistent access (~1 month)